---
id: "CVE-2026-111446"
kind: "vulnerability"
aliases: ["CVE-2026-111446"]
title: "Wheels: development tools exposed to remote clients, leaking settings and running tests"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["coldfusion", "lucee", "runtime", "self-hosted", "wheels"]
not_affected_if: ["default-config", "local-only-access"]
published_at: "2026-10-16T04:18:30+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:00:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111446", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Wheels: development tools exposed to remote clients, leaking settings and running tests

Wheels 4.0.0 through 4.1.2 serves password-less development tools under /wheels/* to remote clients when enablePublicComponent is true, which is the development default. A remote client can read application settings, environment and datasource details, and routes, and start test runs that can write to the real database when tests use the primary datasource.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the framework version in the project's Wheels dependency, flagging `4.0.0` through `4.1.2`.
- Check `enablePublicComponent` in the Wheels settings; `true` exposes the tools.
- Request `/wheels/` on a deployed host from outside the network and see whether the tools respond.

## Fix

- Upgrade Wheels to `4.2.0`.
- Until upgraded, set `enablePublicComponent` to `false` and block `/wheels/*` at the edge.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111446

## From the sources

Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development. Before 4.1.2 these tools have no local-access restriction; in 4.1.2 the restriction trusts client-supplied headers without checking the connecting peer. Remote clients can obtain application settings, environment/datasource details and routes, and start test runs. Where application tests use the primary datasource, those runs can write to the real application database. The separately protected migrator and CLI endpoints are not affected. This is fixed in 4.2.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_